Formal Methods Specification and Analysis Guidebook for the Verification of Software and Computer Systems
Total Page:16
File Type:pdf, Size:1020Kb
OIIICI 01 Sill 1) l\l)\llsslo\ \%s( l{\\cl NASA-GB-O01-97 1{1 I I \\l 1 (1 Formal Methods Specification and Analysis Guidebook for the Verification of Software and Computer Systems Volume 11: A Practitioner’s Companion May 1997 L*L● National Aeronautics and Space Administration @ Washington, DC 20546 NASA-GB-001-97 Release 1.0 FORMAL METHODS SPECIFICATION AND ANALYSIS GUIDEBOOK FOR THE VERIFICATION OF SOFTWARE AND COMPUTER SYSTEMS VOLUME II: A PRACTITIONER’S COMPANION FOREWORD This volume presents technical issues involved in applying mathematical techniques known as Formal Methods to specify and analytically verify aerospace and avionics software systems. The first volume, NASA-GB-002-95 [NASA-95a], dealt with planning and technology insertion. This second volume discusses practical techniques and strategies for verifying requirements and high-level designs for software intensive systems. The discussion is illustrated with a realistic example based on NASA’s Simplified Aid for EVA (Extravehicular Activity) Rescue [SAFER94a, SAFER94b]. The vohu-ne is intended as a “companion” and guide for the novice formal methods and analytical verification practitioner. Together, the two volumes address the recognized need for new technologies and improved techniques to meet the demands inherent in developing increasingly complex and autonomous systems. The support of NASA’s Safety and Mission Quality Office for the investigation of formal methods and analytical verification techniques reflects the growing practicality of these approaches for enhancing the quality of aerospace and avionics applications. Major contributors to the guidebook include Judith Crow, lead author (SRI International); Ben Di Vito, SAFER example author (ViGYAN); Robyn Lutz (NASA - JPL); Larry Roberts (Lockheed Martin Space Mission Systems and Services); Martin Feather (NASA - JPL); and John Kelly (NASA - JPL), task lead. Special thanks go to John Rushby (SRI International) who provided valuable material and guidance, Sam chvre (SRI International) who graciously supplied wide-ranging technical expertise, Gerard Holzrnann (Lucent Technologies) and Peter Germ Larsen (IFAD) both of whom gave particularly thorough and thoughtful reviews, and Valerie Mathews (NASA - JPL) who served as guidebook review and publication coordinator. Special acknowledgment is also extended to NASA sponsors Kathryn Kemp (Deputy Director, NASA IV&V Facility), George Sabolish (NASA - Ames), Rick Butler (NASA - Langley), and Ernie Fridge (NASA- Johnson). This document is a product of NASA’s Software Program, an agency-wide program that promotes continual improvement in software engineering and assurance within NASA. The goals and strategies of this program are documented in the NASA Software Strategic Plan. [NASA-95b] Funding for this guidebook was provided by NASA’s Office of Safety and Mission Assurance. Additional information about this program and its products is available via the World Wide Web at http:// www.ivv.nasa.gov. NASA-GB-O01-97 Release 1.0 m Office of Safety and Mission Assurance s Formal Methods Specification and Analysis Guidebook for the I Verification of Software and Computer Systems $ Volume II: A Practitioner’s Companion May, 1997 Approvals: 1 ------ \ ‘\. ‘ . ...--’., _]&i-d L’ . ,e ‘, _Q”&_ n Task Lead . 1 Jet Propulsion Laboratory Pasadena, CA B ——. Conc{mence for Publication Kathryn Kemp a NASA OSMA Software Program, Manager NASA IV&V Facility Fairmont, WV c This guidebook is one of the products of a cooperative study to investigate the applicability of Formal Methods and Analytical Verification for critical NASA F software systems. This guidebook was jointly developed through cooperative work from three NASA centers: Jet Propulsion Laboratory, Johnson Space B Center, and Langley Research Center. 9 Contents 1 Introduction 1 2 The Practical Application of Formal Methods 4 Q.1 w]lat Ar~~orI]lal Mctllods?. 4 2.2 Rolwof FornlalMethods. ...5 2.3 Formal Methods: Degree of Formalization and Scope of Use . 5 2.3.1 Levels of Formalization . 6 2.3.2 Scope of Formal Methods [Jsc . 7 2.4 Reasonable Expectations for Formal Methods . 8 2.5 The Method lJndcrlyiug Formal Mctllods . ~ 2.6 Au Introduction toSAFER . 12 3 Requirements 17 3.1 Requirements and Formal Methods . 18 3.1.1 Impact of Requirements Spccificatio~l on Formal Methods . 18 3.1.1.1 I,evcl of Requirenlents Capture . 18 3.1.1.2 Explicitness of Recluirenmnts Statement . 18 3.1.1.3 Clarity of Delineation between a System and Its Envi- ronulmt . 18 3.1.1.4 Traceability of Recluirements . 19 3.1.1.5 Availability of Underlying Rationale and Intuition . 19 3.1.2 Impact of Formal Methocls on Requirements . 20 3.2 Conventional Approaches to Requirements Validation . 21 3.3 SAFER Requirements . 23 vii . vlll q hbJe Of (;Olltf!I1tS 4 hlodels 25 4.1hIathen~atica lModcl s.... 25 4.1.1 Characteristics of Nlatllematica] Models . 26 4.1.1.1 Abstractic)~l . 26 4. I. I.2 Focus . 27 4.1. ].3 Exl)ressivel~ess l~ersus Analytic Power . 27 4.1.1.4 Intuit ive Versus Nonilltuitive Representation . 28 4.]. ].5 Accuracy . ...”” 28 4.1.2 Bencfitsof Mathematical Models . 28 4.1.3 Mathenlatical h!lodels for Discrete and Continuous Donlains . 29 4.2 Colltil~uo~ls Dol[laill Modclitlg . 3(I 4.3 Discretc l)omainh lodeli% . 32 4.3.1 Functional hIc)dels . 32 4.3.2 Abstract, State hlachine Models . 34 4.3.3 Automata-Based Models . 36 4.3.3.1 *- Autonlata . 36 4.3.3.2 ti-Autonlata . 38 4.3.3.3 Tind Autonlata . 38 4.3.3.4 Hybrid Autonlata . 39 4.3.4 object-oriented” Models . 39 4.4 A Model for the SAFER Avionics Controller . 45 5 Formal Specification 50 .5.1 Fornlal Specification Lauguages . 51 5.1.1 Foundations . 51 5.1.2 Fcaturcs . 53 5.1.2.1 Explicit Senlantic s........ 54 5.1.2.2 Expressiveness . 54 5.1.2.3 Progranln~ing Language Datatypes and Constructions . 55 55 5.1.2.4 Convenient Syntax . 5.1 .2.5 Diagranln~atic hTotation . 55 5.1.2 .6 Strong Type% . 55 5.1.2.7 ‘1’otal versus Partial Functions . 56 5.1.2 .8 Refilmnent . 57 ATASA- GB-001 -97 ix 5.1.2.9 I1ltroduction of Axiolns aud I)efiuitious . 57 5.1.2.10 Encapsulation N4echauism . 59 5.1.2.11 Ruilt-iu Model of Coml)utation . 6(I 5.1.2 .12 FJxecutability. 60 5.1.2 .13 Maturity . 61 5.2 Formal Specification Styles . 61 5.3 Formal Specification atd Life Cycle . fjz 5.4 TIN Detection of Errors iu Formal Specification . 63 5.5 The Utility of Fmmal Spccificaticnl . (Xi 5.6 A Partial SAFER S1wcification . 69 ‘ 6 Formal Analysis 77 6.1 Autol~latcdD ed~lctic)ll. 77 6.1.1 Background: Fornlal Systems and !f’heir Models . 78 (i.l.l. ll)roofrl’heor y..... 78 6.1.1.2hIodcl ?’llc:ory . 8(I 6.1.1.3 An Exanq)le of a First-Ordcx Theory . 81 6.1.2 A Brief History of Automated Proof . 82 6.1.3 Techniques Underlying Automated Reasoniug . 85 6.1.3.1 Calculi for 14’irst-Order Predicate I,ogic . 85 6.1.3.1.1 NTornlal Porlns . 86 6.1.3.1.2 The Sequent Calculus . 86 6.1.3.1.3 The Resolution Calculus . 91 6.1.3.2 Extcncling the Predicate Calculus . 92 6.1.3.2.1 Reasonin~ about 13cluality . 93 6.1.3.2.2 Reasoning about Arithuletic . 95 6.1.3.2.3 Combiuing First-order Theories . 95 6.1.3.3 Mechanization of Proof ill tile Sequent Calculus . 96 6.1.4 Utility of Automated Dcdllctioll . 100 6.2 Finite-State Methods . 101 6.2.1 Background . 102 6.2.1.1 TemporalIJ o.gic . 102 6.2.1.2 Liuear Tenll)oral Logic (LT1.) . } 04 6.2.1.3 Brauching Time lhnporal Logic . 105 x 7hble of @IltC!Ilt S 6.2.1.4 Fixed Points . 108 6.2.1.5 The Mu-Calculus . 108 6.2.2 ABrief History of Finite-State Methods . 110 6.2.3 Approaches tc) Finite-State Verification . 112 6.2.3.1 The $@)olic Mode] Checkilig Approach . 112 6.2.3.2 ‘l’lie Automata-Theoretic Approach . 114 6.2.3.2.1 l,anguage Containment . 115 6.2.3.2.2 State Exploration . 116 6.2.3.2.3 Bisinlulatioli Equivalence and Prebisimulation Preorclers . 118 6.2.4 Utility of Finite-State Methods . 119 6.3 Direct Execution, Simulation, and Animation . 119 6.3.1 Obscrvaticnlal Techniques . 120 6.3.2 Utility of observational Techniques . 121 6.4 Integrating Autolnatcd Analysis Methods . 122 6.5 Proof of Selected SAFER Pro]wrty . 122 6.5.1 The PVS Theory SAFER-properties . 123 6.5.2 Informal Argument for I.cnma max.thrusters_sel . 126 7 conclusion 130 7.1 Factors Influencing the Use of Formal hiethods . 130 7.2 The Process of Fcmnal Methods . 131 7.3 F’airing Formal Methods, Strategy, and Task . 132 7.4 Formal h4cthods and Existing Quality Control and Assurance Activities . .133 7.5 Formal h4ethods: Verification Versus Validation and Explorat ioll . 134 References 136 A Glossary of Key Terms 165 A.l Acronyms . ...165 A.2Ternl s . ...166 B Further Reading 169 11.1 Technical Background: h4athenlatical lmgic . 169 11.2 Specificatio n . ...170 H.3hIodel Checkin g....... ...170 B.4Thcorenl Proving . ...171 1].5 hIodels of Conlputation . 171 B.6 Applications aud Overvicws . 172 1].7111torials . ...172 C Extended Example: Simplified Aid for EVA Rescue (SAFER) 174 C.lOvervicw of SAFER . .174 C.].1 History, Mission Colltext, atld System Description . 174 C.1.2 Principal Hardware Components . 176 C.1.2.1 Ilackpack Propulsio:l h40dule . 176 C.] .2.2 IIaud Controller hlodulc (HChI) . 177 C.1.2.3 BatteryP ace .